Runtime detection of code modification

Abstract

A new layer for runtime detection of vendor hooks, with respect to a program module, includes mapping of branching instructions and their respective targets. When the program module is compiled, branch instructions are mapped and recorded to generate one or more branch maps. A branch map includes target program module addresses (or associated respective placeholders) and respective instruction offsets. At runtime, placeholders are replaced with respective target program module addresses. At runtime, actual branching information is compared to branching information included in the branch map. If a discrepancy is detected between runtime branching information and the corresponding branching information recorded in the branch map, a responsive action is triggered.

What is claimed is: 
     
       1. A method comprising:
 generating an external branch map, associated with a program module having a program module starting address, where the external branch map includes partial mapping information pertaining to a first branch instruction of the program module, wherein the first branch instruction targets a first instruction within a software module that is distinct from the program module; 
 loading the program module for execution by a processor; 
 updating the external branch map with target module address information determined at load time, to generate complete mapping information pertaining to the first branch instruction; 
 reading, from the external branch map, the complete mapping information pertaining to the first branch instruction; 
 determining runtime mapping information pertaining to the first branch instruction; 
 determining that a first discrepancy exists between the complete mapping information pertaining to the first branch instruction and the runtime mapping information pertaining to the first branch instruction; and 
 in response to determining that the first discrepancy exists, performing a responsive action. 
 
     
     
       2. The method of  claim 1 , further comprising:
 generating an internal branch map, associated with the program module, where the internal branch map includes complete mapping information pertaining to a second branch instruction of the program the program module; wherein the second branch instruction targets a second instruction within the program module; 
 reading, from the internal branch map, the complete mapping information pertaining to the second branch instruction; 
 determining runtime mapping information pertaining to the second branch instruction; 
 determining that a second discrepancy exists between the complete mapping information pertaining to the second branch instruction and the runtime mapping information pertaining to the second branch instruction; 
 in response to determining that the second discrepancy exists, performing the responsive action. 
 
     
     
       3. The method of  claim 2 , wherein the responsive action is selected from the group consisting of:
 generating discrepancy information and logging the discrepancy information on a storage device; 
 terminating execution of the program module; 
 sending an alert signal to a receiving device; and 
 modifying an instruction sequence (program flow) of the program module. 
 
     
     
       4. The method of  claim 1 , wherein the partial mapping information pertaining to the first branch instruction comprises:
 a first branch instruction identifier; and 
 a first instruction offset. 
 
     
     
       5. The method of  claim 4 , wherein the complete mapping information pertaining to the first branch instruction comprises:
 a first target module starting address. 
 
     
     
       6. The method of  claim 2 , wherein the complete mapping information pertaining to the second branch instruction comprises:
 a second branch instruction identifier; 
 the program module starting address; and 
 a second instruction offset. 
 
     
     
       7. A computer program product comprising:
 one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions comprising instructions to perform:
 generating an external branch map, associated with a program module having a program module starting address, where the external branch map includes partial mapping information pertaining to a first branch instruction of the program module, wherein the first branch instruction targets a first instruction within a software module that is distinct from the program module; 
 loading the program module for execution by a processor; 
 updating the external branch map with target module address information determined at load time, to generate complete mapping information pertaining to the first branch instruction; 
 reading, from the external branch map, the complete mapping information pertaining to the first branch instruction; 
 determining runtime mapping information pertaining to the first branch instruction; 
 determining that a first discrepancy exists between the complete mapping information pertaining to the first branch instruction and the runtime mapping information pertaining to the first branch instruction; and
 in response to determining that the first discrepancy exists, performing a responsive action. 
 
 
 
     
     
       8. The computer program product of  claim 7 , further comprising program instructions programmed to perform:
 generating an internal branch map, associated with the program module, where the internal branch map includes complete mapping information pertaining to a second branch instruction of the program module, and the second branch instruction targets a second instruction within the program module; 
 reading, from the internal branch map, the complete mapping information pertaining to the second branch instruction; 
 determining runtime mapping information pertaining to the second branch instruction; 
 determining that a second discrepancy exists between the complete mapping information pertaining to the second branch instruction and the runtime mapping information pertaining to the second branch instruction; and 
 in response to determining that the second discrepancy exists, performing the responsive action. 
 
     
     
       9. The computer program product of  claim 8 , wherein the responsive action is selected from the group consisting of:
 generating discrepancy information and logging the discrepancy information on a storage device; 
 terminating execution of the program module; 
 sending an alert signal to a receiving device; and 
 modifying an instruction sequence (program flow) of the program module. 
 
     
     
       10. The computer program product of  claim 7 , wherein the partial mapping information pertaining to the first branch instruction comprises:
 a first branch instruction identifier; and 
 a first instruction offset. 
 
     
     
       11. The computer program product of  claim 10 , wherein the complete mapping information pertaining to the first branch instruction comprises:
 a first target module starting address. 
 
     
     
       12. The computer program product of  claim 8 , wherein the complete mapping information pertaining to the second branch instruction comprises:
 a second branch instruction identifier; 
 the program module starting address; and 
 a second instruction offset. 
 
     
     
       13. A computer system comprising:
 one or more computer processors; 
 one or more computer-readable storage media; 
 program instructions stored on the computer-readable storage media for execution by at least one of the one or more processors, the program instructions comprising instructions to perform:
 generating an external branch map, associated with a program module having a program module starting address, where the external branch map includes partial mapping information pertaining to a first branch instruction of the program module, wherein the first branch instruction targets a first instruction within a software module that is distinct form the program module; 
 loading the program module for execution by a processor; 
 updating the external branch map with target module address information determined at load time, to generate complete mapping information pertaining to the first branch instruction; 
 reading, from the external branch map, the complete mapping information pertaining to the first branch instruction; 
 determining runtime mapping information pertaining to the first branch instruction; 
 determining that a first discrepancy exists between the complete mapping information pertaining to the first branch instruction and the runtime mapping information pertaining to the first branch instruction; and 
 in response to determining that the first discrepancy exists, performing a responsive action. 
 
 
     
     
       14. The computer system of  claim 13 , further comprising:
 generating an internal branch map, associated with the program module, where the internal branch map includes complete mapping information pertaining to a second branch instruction of the program module, and the second branch instruction targets a second instruction within the program module; 
 reading, from the internal branch map, the complete mapping information pertaining to the second branch instruction; 
 determining runtime mapping information pertaining to the second branch instruction; 
 determining that a second discrepancy exists between the complete mapping information pertaining to the second branch instruction and the runtime mapping information pertaining to the second branch instruction; 
 in response to determining that the second discrepancy exists, performing the responsive action. 
 
     
     
       15. The computer system of  claim 14 , wherein the responsive action is selected from the group consisting of:
 generating discrepancy information and logging the discrepancy information on a storage device; 
 terminating execution of the program module; 
 sending an alert signal to a receiving device; and 
 modifying an instruction sequence (program flow) of the program module. 
 
     
     
       16. The computer system of  claim 13 , wherein the partial mapping information pertaining to the first branch instruction comprises:
 a first branch instruction identifier; and 
 a first instruction offset. 
 
     
     
       17. The computer system of  claim 16 , wherein the complete mapping information pertaining to the first branch instruction comprises:
 a first target module starting address. 
 
     
     
       18. The computer system of  claim 14 , wherein the complete mapping information pertaining to the second branch instruction comprises:
 a second branch instruction identifier; 
 the program module starting address; and 
 a second instruction offset.